From a5800f84dbef9ab35395aabdced115c09a81f29a Mon Sep 17 00:00:00 2001 From: Xavier Mehrenberger Date: Fri, 8 Jun 2018 10:47:08 +0200 Subject: [PATCH 1/2] chg: fix sample retrieval from new-style zips --- pymisp/api.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pymisp/api.py b/pymisp/api.py index d9e8b0a..5e7c8ad 100644 --- a/pymisp/api.py +++ b/pymisp/api.py @@ -1210,7 +1210,7 @@ class PyMISP(object): zipped = BytesIO(decoded) try: archive = zipfile.ZipFile(zipped) - if f.get('md5') and f['md5'] in archive.infolist(): + if f.get('md5') and f['md5'] in archive.namelist(): # New format unzipped = BytesIO(archive.open(f['md5'], pwd=b'infected').read()) else: From 26fa04428d9cae42e919742b20fe5d6153d83b30 Mon Sep 17 00:00:00 2001 From: Steffen Sauler Date: Tue, 12 Jun 2018 16:16:40 +0200 Subject: [PATCH 2/2] Added unzip-flag added: download_samples(..., unzip=True) --- pymisp/api.py | 30 ++++++++++++++++-------------- 1 file changed, 16 insertions(+), 14 deletions(-) diff --git a/pymisp/api.py b/pymisp/api.py index 5e7c8ad..96b0c38 100644 --- a/pymisp/api.py +++ b/pymisp/api.py @@ -1194,7 +1194,7 @@ class PyMISP(object): rules = '\n\n'.join([a['value'] for a in result['response']['Attribute']]) return True, rules - def download_samples(self, sample_hash=None, event_id=None, all_samples=False): + def download_samples(self, sample_hash=None, event_id=None, all_samples=False, unzip=True): """Download samples, by hash or event ID. If there are multiple samples in one event, use the all_samples switch""" url = urljoin(self.root_url, 'attributes/downloadSample') to_post = {'request': {'hash': sample_hash, 'eventID': event_id, 'allSamples': all_samples}} @@ -1208,19 +1208,21 @@ class PyMISP(object): for f in result['result']: decoded = base64.b64decode(f['base64']) zipped = BytesIO(decoded) - try: - archive = zipfile.ZipFile(zipped) - if f.get('md5') and f['md5'] in archive.namelist(): - # New format - unzipped = BytesIO(archive.open(f['md5'], pwd=b'infected').read()) - else: - # Old format - unzipped = BytesIO(archive.open(f['filename'], pwd=b'infected').read()) - details.append([f['event_id'], f['filename'], unzipped]) - except zipfile.BadZipfile: - # In case the sample isn't zipped - details.append([f['event_id'], f['filename'], zipped]) - + if unzip: + try: + archive = zipfile.ZipFile(zipped) + if f.get('md5') and f['md5'] in archive.namelist(): + # New format + unzipped = BytesIO(archive.open(f['md5'], pwd=b'infected').read()) + else: + # Old format + unzipped = BytesIO(archive.open(f['filename'], pwd=b'infected').read()) + details.append([f['event_id'], f['filename'], unzipped]) + except zipfile.BadZipfile: + # In case the sample isn't zipped + details.append([f['event_id'], f['filename'], zipped]) + else: + details.append([f['event_id'], "{0}.zip".format(f['filename']), zipped]) return True, details def download_last(self, last):